Scutil is referenced without full path #188

New Issue

michael · 2026-01-19T18:29:34Z

michael commented

2026-01-19 18:29:34 +00:00

Originally created by @wintererik on GitHub.

Summary

If /usr/sbin is not on the $PATH then running the guidance script in "check" mode will fail for some rules. This is due to that the CURRENT_USER is determined running the scutil command without specifying its full path.

Steps to reproduce

Run the guidance script in "check" mode from a cron job.

Operating System version

Ventura 13.2.1

Intel or Apple Silicon

Apple Silicon

What is the current bug behavior?

system_settings_bluetooth_sharing_disable fails when running the guidance script in "check" mode from a cron job, with the following output.

usage: sudo -h | -K | -k | -V
usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
usage: sudo [-AbEHknPS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] [VAR=value] [-i|-s] [<command>]
usage: sudo -e [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...

This is due to that the CURRENT_USER variable is empty when running in a cron job. In the cron jobs then /usr/sbin is not in the $PATH.

What is the expected correct behavior?

No difference in result although running in an environment which does not have /usr/sbin included in the $PATH.
E.g. in our case we tried to run the script scheduled with cron.

Relevant logs and/or screenshots

Output of checks

Possible fixes

The guidance script defines CURRENT_USER here:
3c8162a1fc/scripts/generate_guidance.py (L609)

In the documentation instead the full path is used to reference the scutil command.

CURRENT_USER=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" \|
 /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3 }' )

Possible fix is to do as in the documentation, i.e. use the full path in the guidance script. I can provide a pull request.

Originally created by @wintererik on GitHub.  ### Summary If /usr/sbin is not on the $PATH then running the guidance script in "check" mode will fail for some rules. This is due to that the CURRENT_USER is determined running the scutil command without specifying its full path. ### Steps to reproduce Run the guidance script in "check" mode from a cron job. ### Operating System version Ventura 13.2.1 ### Intel or Apple Silicon Apple Silicon ### What is the current *bug* behavior? system_settings_bluetooth_sharing_disable fails when running the guidance script in "check" mode from a cron job, with the following output. ``` usage: sudo -h | -K | -k | -V usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user] usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command] usage: sudo [-AbEHknPS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] [VAR=value] [-i|-s] [<command>] usage: sudo -e [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ... ``` This is due to that the CURRENT_USER variable is empty when running in a cron job. In the cron jobs then /usr/sbin is not in the $PATH. ### What is the expected *correct* behavior? No difference in result although running in an environment which does not have /usr/sbin included in the $PATH. E.g. in our case we tried to run the script scheduled with cron. ### Relevant logs and/or screenshots ### Output of checks ### Possible fixes The guidance script defines CURRENT_USER here: https://github.com/usnistgov/macos_security/blob/3c8162a1fcb313fc3b503d1519d29148d13e8005/scripts/generate_guidance.py#L609 In the documentation instead the full path is used to reference the scutil command. ``` CURRENT_USER=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" \| /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3 }' ) ``` Possible fix is to do as in the documentation, i.e. use the full path in the guidance script. I can provide a pull request.

michael closed this issue

2026-01-19 18:29:34 +00:00

michael commented

2026-01-19 18:29:35 +00:00

@wintererik commented on GitHub:

Pull request created #239

@wintererik commented on GitHub: Pull request created #239

michael commented

2026-01-19 18:29:35 +00:00

@robertgendler commented on GitHub:

Pull request would be awesome. If you do, make it against an OS branch, not main please

We're always trying to make sure we use full path as much as possible, but definitely have missed occasional spots through out the project.

@robertgendler commented on GitHub: Pull request would be awesome. If you do, make it against an OS branch, not main please We're always trying to make sure we use full path as much as possible, but definitely have missed occasional spots through out the project.

michael commented

2026-01-19 18:29:35 +00:00

@wintererik commented on GitHub:

Ok, perfect. Will get back with a pull request.

@wintererik commented on GitHub: Ok, perfect. Will get back with a pull request.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#188